141–150 of 218 posts
Earlier quoted context omitted.
"Some are in the middle, like my LinkedIn account, or my gmail account" Your email account is the golden key to all other accounts that send "forgot password" links to it.
I don't use it myself but I would think that you wouldn't want your "professional" social network account to fall in the wrong hands either.
Earlier quoted context omitted.
I don't like that you have to specify a fixed number of numbers, special chars, etc.
if it's truly random, then you need to if you want to guarantee you have at least 1 of various character classes..
And LinkedIn is now asking me to enter my phone number: "Add an extra layer of security to your account. Add your phone number." Leaking my email / password is bad enough; I'm not going to give them my phone number for more damages!
(The attack is not very scalable, but easy enough to pull off against individual targets.)
Earlier quoted context omitted.
2009... Awesome. Linkedin should probably be the one warning me about this, but I never heard of this before. Edit: filtered as Spam, nevertheless they should have locked my account.
I believe it's been proven impossible to write a spam filter to distinguish useful LinkedIn email from spammy LinkedIn emails, since the spam filter would then be able to solve the halting problem.
isUseful :: LinkedInMessage -> Bool
isUseful _ = False> test sample passwords with our password checker here. Do NOT do that with your exact password though :)
Link: https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.
Earlier quoted context omitted.
How do you randomly generate these passwords?
I like the password generator and virtual dice roller on https://www.random.org , but I guess it requires one to trust their claims that they are getting numbers from atmospheric noise and not a PRNG secretly.
The "PRNG" vs "Real RNG" boogeyman scare is such a load of horseshit.
The whole point of modern PRNGs is that they're good enough computers can't detect patterns. I assure you that you're gaining zero security by using random.org vs openssl rand... and in fact, you're losing massive amounts of security because it's going over the network.
1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
As an aside, it can be so difficult to get this across to folks who aren't in the infosec headspace. I've seen even technical, computer science types absolutely not get that their ad-hoc memorable password "but no one would EVER guess that!" schemes are probably much more vulnerable than they estimate. Nevermind, even, true computing laypersons.
Earlier quoted context omitted.
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
That is a good choice, and it is what I recommend to whoever will listen to me, and a few that won't. I use and recommend 1Password. To evaluate a password manager, check this page https://discussions.agilebits.com/discussion/15416/1password... for good questions to ask. For example, what data they can turn over, what their encryption practices are. Key phrase: "There is no data of yours that we keep, so there is not…
> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…
> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…